CVE-2026-12003: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-2wqx-fp26-qh5v
Share
CWE-427
Published
Advisory Summary

CVE-2026-12003 is a MODERATE security vulnerability vulnerability (CWE-427: Uncontrolled Search Path Element) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-12003 at a Glance

CVE Identifier CVE-2026-12003
GHSA Identifier GHSA-2wqx-fp26-qh5v
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-427: Uncontrolled Search Path Element
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-12003

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-12003, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-427: Uncontrolled Search Path Element, where the product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree. On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise restricted install. Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive. Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a `Modules` directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources. Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory. The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so builds will need to generate or preserve the pybuilddir.txt file in order to work in-tree. This landmark file has been generated on Windows since 3.11, and on other platforms for longer.

References

NVD — CVE-2026-12003 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12003
Software Source Repository REPOSITORY
https://github.com/python/cpython/issues/151544
Software Source Repository REPOSITORY
https://github.com/python/cpython/pull/151545
Security Fix Commit FIX COMMIT
https://github.com/python/cpython/commit/03ab7b44788bfd6b8927e16bcdbd025aa08dce06
Security Fix Commit FIX COMMIT
https://github.com/python/cpython/commit/16c40f944b7bff724a403cf4902763d095bb4b2a
Security Fix Commit FIX COMMIT
https://github.com/python/cpython/commit/872038377db2e170e0e140b5f8aaedf636b3fbf5
Security Fix Commit FIX COMMIT
https://github.com/python/cpython/commit/9e863fab283eddca9c2a8f9d1ee30f4dc243e314
Security Fix Commit FIX COMMIT
https://github.com/python/cpython/commit/a86de0bc236fbb9452f98998fc8437e9fca35700
Security Fix Commit FIX COMMIT
https://github.com/python/cpython/commit/b93d6d3399adbd3a5037b6b92fc3587c85ac5d56
Software Security Information SECURITY
https://https://mail.python.org/archives/list/security-announce@python.org/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH
Software Security Information SECURITY
http://www.openwall.com/lists/oss-security/2026/06/16/8

Frequently Asked Questions

What is CVE-2026-12003?
CVE-2026-12003 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-427: Uncontrolled Search Path Element.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-12003?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-12003?
CVE-2026-12003 is classified under CWE-427: Uncontrolled Search Path Element (The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.).
How can I check Maven dependencies for CVE-2026-12003?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2wqx-fp26-qh5v",
  "modified" : "2026-08-11T03:31:50Z",
  "published" : "2026-06-16T18:32:38Z",
  "aliases" : [ "CVE-2026-12003" ],
  "details" : "To allow builds of Python to be run from an in-tree layout (rather than\nan installed file layout), the VPATH variable is defined at build time\nand used to locate certain landmarks - specifically,\nModules/setup.local. When this landmark is found relative to VPATH\nrelative to the executable, Python assumes it is running in a source\ntree and generates a different default sys.path. This code remains in\nrelease builds, so that release-ready builds can be built in-tree.\n\nOn Windows, since builds are written to 'PCbuild/', the value of\nVPATH is set to '..\\..', which results in a landmark of\n'..\\..\\Modules\\setup.local'. This path is outside the install directory\nof Python, and may have different permissions, potentially allowing a\nlow-privilege user to create the landmark and an alternative `Lib`\nfolder that will be discovered by an otherwise restricted install.\n\nSuch a setup occurs with the legacy default install location for all\nusers (in the now superseded EXE installer), due to how Windows allows\nall users to create folders in the root directory of their OS drive.\n\nOur recommended mitigation on Windows is to migrate away from the\nlegacy installer and use the new [Python install\nmanager](https://www.python.org/downloads/latest/pymanager/) to install\nfor the current user. Installs where the directory two levels above the\nPython installation directory have equivalent permissions are unaffected\n(in general, a per-user install cannot be modified at all by other\nusers, removing any escalation of privilege risk, and could be directly\nmodified by a privileged user, making the potential tampering\nirrelevant). Alternative mitigations might include preemptively creating\nand restricting access to a `Modules` directory. Be aware that only 3.13\nand 3.14 will receive updated legacy installers - earlier fixes are only\nprovided as sources.\n\nPlatforms other than Windows allow VPATH to be overridden, but as they\ndon't usually use a separated directory in the build for binaries, are\nunlikely to have a landmark reference outside of the install directory.\n\nThe landmark detection involving VPATH is a fallback for when a more\nspecific landmark - .\\pybuilddir.txt - is absent, and was included for\ncompatibility. Future releases of Python will no longer include the\nfallback, and so builds will need to generate or preserve the\npybuilddir.txt file in order to work in-tree. This landmark file has\nbeen generated on Windows since 3.11, and on other platforms for longer.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-12003"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python/cpython/issues/151544"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python/cpython/pull/151545"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python/cpython/commit/03ab7b44788bfd6b8927e16bcdbd025aa08dce06"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python/cpython/commit/16c40f944b7bff724a403cf4902763d095bb4b2a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python/cpython/commit/872038377db2e170e0e140b5f8aaedf636b3fbf5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python/cpython/commit/9e863fab283eddca9c2a8f9d1ee30f4dc243e314"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python/cpython/commit/a86de0bc236fbb9452f98998fc8437e9fca35700"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python/cpython/commit/b93d6d3399adbd3a5037b6b92fc3587c85ac5d56"
  }, {
    "type" : "WEB",
    "url" : "https://https://mail.python.org/archives/list/security-announce@python.org/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2026/06/16/8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-427" ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-06-16T17:16:31Z"
  }
}